Privacy Policy

Hala Mobility India Private Limited ("Hala", "we", "our" or "the Company"), having its registered office at Plot No. 18/2, 3rd Floor, Sector III, Huda Techno Enclave, Madhapur, Hyderabad, Shaikpet, Telangana, India 500081, operates an electric vehicle rental and subscription platform through its website and mobile application. This policy explains what personal data we collect from riders and other users of our platform, how we use it, who we share it with, and what rights you have over it.

• 1. Introduction and scope:
  This policy applies to anyone who uses the Hala app or website, rents a vehicle from us, or otherwise submits personal data to us. By using our services you acknowledge that you have read and understood this policy. Where your consent is required for a particular activity, we ask for it separately, consent is never assumed from general use of the platform.
  
  We process personal data in line with the Digital Personal Data Protection Act 2023 and the rules made under it, the Information Technology Act 2000 and the rules made under it, and other applicable Indian law.
• 2. Personal data we collect:
  We collect only what is needed to verify who you are, let you book and use a vehicle, keep our fleet and riders safe, and meet our legal obligations.
  • • 2.1 Identity and KYC information: When you sign up, we collect your name, date of birth, address, mobile number and email address. To complete KYC before your first booking we collect a copy of your PAN, your Aadhaar details, and where applicable your driving licence, along with a photograph taken through the app for identity verification. Where you choose to verify your Aadhaar through DigiLocker or through Aadhaar Offline Verification, we receive only the demographic details and photograph needed for KYC, we do not receive or store your Aadhaar number in full or any biometric data, and this method is entirely optional, you may instead complete KYC using your PAN and driving licence. Proof of local address, such as a recent electricity bill, may also be requested during onboarding.
  • • 2.2 Booking and vehicle use: We collect details of each booking, including the vehicle, plan, duration, pick up and drop off point, vehicle condition at handover and return, and any incident or late return record. Where you sign a physical handover form at one of our hubs, we retain that signed copy along with the identity documents attached to it.
  • • 2.3 Location: We collect your live location only while you have an active booking, to locate the vehicle during a ride and to help recover it if it is not returned. Location access can be withdrawn at any time from your device settings, though this may limit certain features.
  • • 2.4 Payment information: We collect your bank account and UPI details for verification and payouts, and records of payments, refunds and security deposits. Card and payment details you enter at checkout are processed directly by our payment partner and are not stored on our systems.
  • • 2.5 Device, app and communication data: We collect device identifiers and the app permissions you grant, such as camera, microphone, contacts and notifications, each used only for the purpose it was requested for, for example the camera for KYC and vehicle condition photos, and notifications for payment and booking updates. With your permission we also access your phone contacts, solely to reach someone who can help us get in touch with you or recover a vehicle if you become unreachable. Calls and chats with our support team may be recorded for training and quality purposes, and details you share through our website enquiry forms are collected to respond to you.
  • • 2.6 Rider partners: If you are onboarded as a rider partner for deployment to one of our business clients, we collect the same identity and KYC information described above, along with your signed deployment form, for the purpose of that deployment.
• 3. How we use your information:
  We use personal data to create and manage your account and complete KYC, which is necessary to provide our services and, for identity documents, a legal requirement; to let you book, unlock, use and return a vehicle; to process payments, refunds, deposits and rider payouts; to provide customer support and resolve complaints; to protect our vehicles and riders, including recovering a vehicle that is not returned, which is a legitimate interest of ours; to send you service related communication such as OTPs, booking and payment updates; and to meet our obligations under applicable tax, labour and motor vehicle law. Where we rely on your consent, for example for marketing messages, we will ask for it separately and you may withdraw it at any time.
• 4. Who we share your data with:
  We do not sell or rent your personal data. We share it only where necessary, with our KYC and identity verification partner, to confirm your identity documents; our payment partner, to process payments, refunds and deposits; our cloud hosting provider, which stores our platform data securely within India; our messaging provider, to send OTPs and service updates; our insurance partner, where you are covered under a policy through us; a business client, where you are deployed as a rider partner with them, limited to what is needed to verify and manage that deployment; and law enforcement, courts or regulators, where required by law, for instance if a vehicle is reported stolen. Each of these parties is permitted to use your data only for the purpose we share it for. If Hala is ever involved in a merger, acquisition or sale of business assets, your data may be transferred as part of that transaction, subject to the same protections described here.
• 5. Cross border transfers:
  We store and process your data within India. If this ever changes, any transfer outside India will be carried out in line with the safeguards required under the Digital Personal Data Protection Act 2023.
• 6. Data retention:
  
  • • Account and KYC records are kept while your account is active, and if you ask us to delete your account, the underlying data is retained only as long as needed for legal, dispute resolution or fraud prevention purposes.
  • • Rider partner deployment records are kept for one to two years after deployment ends.
  • • Financial and vendor records are kept for eight years to meet income tax requirements.
  • • Employment records are kept as required under applicable labour law.
  • • One time passwords are valid for five minutes and are not retained after that.
  Where data is no longer needed for the purpose it was collected for, and we are not required by law to keep it, we delete or anonymise it.
• 7. Security and data breach response:
  We use encryption for data at rest and in transit, restrict access to personal data on a role basis with logging, and limit direct database access to a small number of authorised personnel. If a personal data breach occurs, we will notify affected users without delay and report it to the Data Protection Board of India within 72 hours of becoming aware of it, as required by law.
• 8. Your rights:
  Subject to applicable law, you may access the personal data we hold about you, ask us to correct or update it, ask us to erase it or deactivate your account where this does not conflict with a legal obligation of ours, withdraw consent for any consent based processing, nominate another person to exercise these rights on your behalf if you die or become incapacitated, and raise a complaint with our Grievance Officer, escalating to the Data Protection Board of India if it remains unresolved. To exercise any of these rights, write to our Grievance Officer using the details in section 12. We aim to respond within 10 business days of a valid request.
• 9. Consent:
  Where we rely on consent, it is collected through a clear affirmative step, such as a checkbox you actively select, and is never assumed from general use of the app. It is sought separately for each distinct purpose. You may withdraw consent at any time by writing to our Grievance Officer, understanding that withdrawing consent needed for KYC may affect our ability to continue providing the service to you.
• 10. Cookies:
  Our website does not currently use cookies or similar tracking technology. If this changes, we will update this policy and seek your consent before any non essential cookie is placed on your device.
• 11. Age requirement:
  Our services are for individuals aged 18 and above. We verify age as part of KYC using the date of birth on the government ID submitted at onboarding, and a booking cannot be completed if this requirement is not met. We do not knowingly collect data from anyone under 18, and if we become aware that we have, we will delete it without delay.
• 12. Grievance redressal:
  If you have a question or concern about how we handle your personal data, contact our Grievance Officer.
  • • Grievance Officer: Mohammad Shahab
  • • Email: support@halamobility.in
  • • Phone and WhatsApp: +91 9032550527
  • • Address: Plot No. 18/2, 3rd Floor, Sector III, Huda Techno Enclave, Madhapur, Hyderabad, Shaikpet, Telangana, India 500081
  We aim to acknowledge grievances promptly and resolve them within 10 business days. If you remain unsatisfied, you may escalate the matter to the Data Protection Board of India.
• 13. Account deactivation and deletion:
  You may request deletion of your account by writing to support@halamobility.in with your registered name and mobile number. Your account will be deactivated on request, and the underlying data will be retained only as long as needed for legal, dispute resolution or fraud prevention purposes, or as otherwise required by law, after which it is deleted or anonymised.
• 14. Changes to this policy:
  We may update this policy from time to time to reflect changes in our practices or in the law. Material changes will be reflected in an updated effective date and posted on our website and app, with notice to you where appropriate. Any change requiring your fresh consent will be preceded by a new consent request.

Hala Mobility is committed to protecting your privacy and to conducting its business in a manner that respects your right to privacy.